auth0 5.14.0 → 5.14.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b34c959171acbebc0ef4f851232de93af1d70318bb762243903d5269275843fa
-  data.tar.gz: 2856980051e6dec9ede6569c185516ffd08d2dfa4918a96a5fc4d0f96e17d44c
+  metadata.gz: d567ac230e46cdb2b8ca43e044179b36d1f6980b0d605f762183e29e4d4f25be
+  data.tar.gz: 87377f3ac5970fcad124b9e0a5923a7e6c753793f0a109efd53e37c9eab43d1e
 SHA512:
-  metadata.gz: 9e551b02de8f4464e4c688259dc0840844aa3cc80111a78254a7082a67b76209e1a991cbe241d7fc3839fea0fac00bdaf0917863d306c54bd51def3db524cc79
-  data.tar.gz: '092c26e20e6b6a850fde55c8beb8f4535a31e20db4144dd001feada3ca4256223580d56e82176ab4264d9146dd0de42610eb77a0ebf7fce9002e489681f9b7ae'
+  metadata.gz: 0bc4c08b46bb4e1d92ad32f4531b97f965bc9b1417458b24dba6ff77c05c9f7b409df62599b1068b5e527df92bb173ca359b7e122a071c6a24a5a1f8427a8943
+  data.tar.gz: a331080bb7f29d8657544da567bb1f414c0688855d6dbf0f8adeead56d7db5c0b977be2b0232346de9540e67b5b6272cd7a165ac3a3211fc80b53514dd39248f

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Change Log
 
+## [v5.14.1](https://github.com/auth0/ruby-auth0/tree/v5.14.1) (2023-07-19)
+[Full Changelog](https://github.com/auth0/ruby-auth0/compare/v5.14.0...v5.14.1)
+
+**Fixed**
+- chore: should not lowercase org_name claim [\#499](https://github.com/auth0/ruby-auth0/pull/499) ([stevehobbsdev](https://github.com/stevehobbsdev))
+
 ## [v5.14.0](https://github.com/auth0/ruby-auth0/tree/v5.14.0) (2023-07-13)
 [Full Changelog](https://github.com/auth0/ruby-auth0/compare/v5.13.0...v5.14.0)
 

data/EXAMPLES.md

@@ -178,7 +178,7 @@ In particular:
 
 - The issuer (iss) claim should be checked to ensure the token was issued by Auth0
 
-- the `org_id` or `org_name` claim should be checked to ensure it is a value that is already known to the application. Which claim you check depends on the organization value being validated: if it starts with `org_`, validate against the `org_id` claim. Otherwise, validate against `org_name`. Further, `org_name` validation should be done using a **case-insensitive** check, whereas `org_id` should be an exact case-sensitive match.
+- the `org_id` or `org_name` claim should be checked to ensure it is a value that is already known to the application. Which claim you check depends on the organization value being validated: if it starts with `org_`, validate against the `org_id` claim. Otherwise, validate against `org_name`. Further, the value of the `org_name` claim will always be lowercase. To aid the developer experience, you may also lowercase the input organization name when checking against the `org_name`, but do not modify the `org_name` claim value.
 
 This could be validated against a known list of organization IDs or names, or perhaps checked in conjunction with the current request URL. e.g. the sub-domain may hint at what organization should be used to validate the Access Token.
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    auth0 (5.14.0)
+    auth0 (5.14.1)
       addressable (~> 2.8)
       jwt (~> 2.7)
       rest-client (~> 2.1)
@@ -65,7 +65,7 @@ GEM
     i18n (1.14.1)
       concurrent-ruby (~> 1.0)
     io-console (0.6.0)
-    irb (1.7.3)
+    irb (1.7.4)
       reline (>= 0.3.6)
     json (2.6.3)
     jwt (2.7.1)
@@ -133,7 +133,7 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.12.0)
     rspec-support (3.12.1)
-    rubocop (1.54.1)
+    rubocop (1.54.2)
       json (~> 2.3)
       language_server-protocol (>= 3.17.0)
       parallel (~> 1.10)

data/lib/auth0/mixins/validation.rb

@@ -204,7 +204,7 @@ module Auth0
               raise Auth0::InvalidIdToken, 'Organization Name (org_name) claim must be a string present in the ID token'
             end
 
-            unless expected.downcase == claims['org_name'].downcase
+            unless expected.downcase == claims['org_name']
               raise Auth0::InvalidIdToken, "Organization Name (org_name) claim value mismatch in the ID token; expected \"#{expected}\","\
                                           " found \"#{claims['org_name']}\""
             end

data/lib/auth0/version.rb

@@ -1,4 +1,4 @@
 # current version of gem
 module Auth0
-  VERSION = '5.14.0'.freeze
+  VERSION = '5.14.1'.freeze
 end

data/spec/lib/auth0/mixins/validation_spec.rb

@@ -342,8 +342,8 @@ describe Auth0::Mixins::Validation::IdTokenValidator do
       end
 
       it 'is expected to NOT raise an error with organization name in different casing' do
-        token = build_id_token org_name: 'MY-ORGANIZATION'
-        instance = Auth0::Mixins::Validation::IdTokenValidator.new(CONTEXT.merge({ organization: 'my-organization' }))
+        token = build_id_token org_name: 'my-organization'
+        instance = Auth0::Mixins::Validation::IdTokenValidator.new(CONTEXT.merge({ organization: 'MY-ORGANIZATION' }))
 
         expect { instance.validate(token) }.not_to raise_exception
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: auth0
 version: !ruby/object:Gem::Version
-  version: 5.14.0
+  version: 5.14.1
 platform: ruby
 authors:
 - Auth0
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-13 00:00:00.000000000 Z
+date: 2023-07-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rest-client